CVE-2023-37912

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-37912
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-37912.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-37912
Aliases
Published
2023-10-25T17:33:54.756Z
Modified
2025-11-29T14:23:54.923436Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
Details

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of org.xwiki.platform:xwiki-core-rendering-macro-footnotes and org.xwiki.platform:xwiki-rendering-macro-footnotes and prior to version 15.1-rc-1 of org.xwiki.platform:xwiki-rendering-macro-footnotes, the footnote macro executed its content in a potentially different context than the one in which it was defined. In particular in combination with the include macro, this allows privilege escalation from a simple user account in XWiki to programming rights and thus remote code execution, impacting the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.6 and 15.1-rc-1. There is no workaround apart from upgrading to a fixed version of the footnote macro.

Database specific 
{
    "cwe_ids": [
        "CWE-270"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37912.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/xwiki/xwiki-rendering

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-rendering
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
351c65f14efa17fbc8dfe0277a5a66ffc3ddc4df
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "14.10.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-rendering
Events
Introduced
9ab0c606476a134fbf6c8257273aff54209e3faf
Fixed
720a021c52aadff58563a6328433810e0ccb5ea9
Database specific 
{
    "versions": [
        {
            "introduced": "15.0-rc-1"
        },
        {
            "fixed": "15.1-rc-1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-37912.json"